Configuring Firefox For Web App Pen Testing

You know the routine: you get a gig doing a web app pen test. You break out Burp (or whatever lesser proxy you prefer), and get ready to ruin some developer’s day. And then, just as you get ready to load the target URL and start, you see a ton of update requests hit the proxy.

It’s annoying. Your logs are polluted, and if you have to turn them over to the client, the extra noise strips some of the professionalism from your image (as a sidenote: Burp’s “only save in-scope items” feature helps quite a lot with this).

Here then, is a quick guide on how to tweak Firefox so that it doesn’t spew stupid crap in your web app pen test log files. I may come back and explain the “why” behind some of these later, but for now, just the “how” will have to do. (Note: some of these settings reduce the security of the browser. My presumption here is that Firefox will only be used for testing, not for general purpose browsing. The settings below reflect that.)

1) Open about:config
2) Disable Safe Browsing
3) Disable Pipelining
4) Disable Pre-fetching
5) Remove all bookmarks
6) Set homepage to about:blank for startup
7) Make sure history is enabled, but disable search suggestions
8) Disable checking for updates
9) Just say no to helping developers
10) Disable updates for sync

That’s it. Now you can go forth, and break all the things, knowing that your log files will be nice and tidy afterwards.